[Bug]: Endless Reconcile as diff is detected

[Sijoma]

Is there an existing issue for this?

• I have searched the existing issues

Affected Resource(s)

• kms.gcp.upbound.io/v1beta2 - CryptoKey

Resource MRs required to reproduce the bug

apiVersion: kms.gcp.upbound.io/v1beta2
kind: CryptoKey
metadata:
  name: d61c10b7-c656-4c41-81b6-6496a8737539
spec:
  deletionPolicy: Delete
  forProvider:
    destroyScheduledDuration: 2592000s
    keyRing: <keyRing>
    purpose: ENCRYPT_DECRYPT
    rotationPeriod: 31536000s
    versionTemplate:
      protectionLevel: SOFTWARE
  initProvider: {}
  managementPolicies:
  - '*'
  providerConfigRef:
    name: <provider-ref>
status:
  atProvider:
    destroyScheduledDuration: 2592000s
    id: <id>
    importOnly: false
    keyRing: <keyRing>
    primary:
    - name: <keyVersion>
      state: ENABLED
    purpose: ENCRYPT_DECRYPT
    rotationPeriod: 31536000s
    skipInitialVersionCreation: false
    versionTemplate:
      algorithm: GOOGLE_SYMMETRIC_ENCRYPTION
      protectionLevel: SOFTWARE
  conditions:
  - lastTransitionTime: "2024-09-03T15:06:11Z"
    reason: Available
    status: "True"
    type: Ready
  - lastTransitionTime: "2024-09-03T15:06:11Z"
    reason: ReconcileSuccess
    status: "True"
    type: Synced
  - lastTransitionTime: "2024-09-03T15:06:11Z"
    reason: Success
    status: "True"
    type: LastAsyncOperation

Steps to Reproduce

1. Create crypto key

What happened?

The crossplane gcp provider pod endless reconciles the resource and logs a diff detected message. This creates a lot of API request against GCP.

Relevant Error Output Snippet

2024-09-06T13:07:20Z	DEBUG	provider-gcp	Diff detected	{"uid": "d762672b-3df5-4a2f-b8a0-fd2956a6847c", "name": "beceffb8-b7cb-46b5-b3d2-3cf34ec16fa3", "gvk": "kms.gcp.upbound.io/v1beta1, Kind=CryptoKey", "instanceDiff": "*terraform.InstanceDiff{mu:sync.Mutex{state:0, sema:0x0}, Attributes:map[string]*terraform.ResourceAttrDiff{\"version_template.0.algorithm\":*terraform.ResourceAttrDiff{Old:\"GOOGLE_SYMMETRIC_ENCRYPTION\", New:\"\", NewComputed:false, NewRemoved:true, NewExtra:interface {}(nil), RequiresNew:false, Sensitive:false, Type:0x0}}, Destroy:false, DestroyDeposed:false, DestroyTainted:false, RawConfig:cty.NilVal, RawState:cty.NilVal, RawPlan:cty.NilVal, Meta:map[string]interface {}(nil)}"}

Crossplane Version

v1.16.0

Provider Version

1.8.0

Kubernetes Version

No response

Kubernetes Distribution

GKE

Additional Info

No response

[Sijoma]

Seems like a workaround is to specify:

versionTemplate:
  algorithm: GOOGLE_SYMMETRIC_ENCRYPTION